Abusing ACLs/ACEs

Basic Information

Active Directory objects such as users and groups are securable objects and DACL/ACEs define who can read/modify these objects (i.e. change account name, reset password, etc).

Example ACEs for the "Domain Admins" object can be seen here from the GUI:

Interesting object permissions and types for attackers:

  • GenericAll - full rights to the object (add users to groups and password reset)

  • GenericWrite - update an object's attributes (i.e. logon script)

  • WriteOwner - change object owner to attacker controlled user to take over the object

  • WriteDACL - modify object's ACEs and give attacker full control over the object

  • AllExtendedRights - ability to add user to a group or reset password

  • ForceChangePassword - ability to change user's password

  • Self (Self-Membership) - ability to add yourself to a group

Exploitation

Granting Write Permissions with dacledit.py

If you have ownership over a group in AD, you can grant write permissions to yourself.

GenericAll on User

Find domain users that current user has GenericAll rights to

Change the password of users with GenericAll rights

Making a User AS-REPRoastable using GenericAll Privileges

requires PowerView.ps1

Enable/Disable AD account remotely via ldap_shell

LogoGitHub - PShlyundin/ldap_shell: AD ACL abuseGitHub

Find domain groups that current user has GenericAll access rights to

Add user accounts to groups with GenericAll privileges

Check for GenericAll rights on object

Using PowerView.ps1, we can check if a user we control has GenericAll rights on an AD object (this this example it will be the michael user:

Reset user's password without knowing current password using net.exe

GenericAll on Group

Check Group ACL/ACE permission

Get distinguishedName from

Then using the distinguishedName value, check the permissions

The rights will be under the ActiveDirectoryRights attribute.

Adding user to group with GenericAll permissions

GenericAll / GenericWrite / Write on Computer

If you have these privileges on a Computer object, you can pull Kerberos Resource-based Constrained Delegation: Computer Object Take Over off.

LogoKerberos Resource-based Constrained Delegation: Computer Object Takeover | Red Team Noteswww.ired.team

GenericWrite on User

WritePropertyon an ObjectType, which in this particular case is Script-Path, allows the attacker to overwrite the logon script path of the delegate user, which means that the next time, when the user delegate logs on, their system will execute the malicious script:

With GenericWrite privileges, we can change the msDS-KeyCredentialLink property to gain full control over an object. If you can wrtie to the msDS-KeyCredentialLink property of a user, you can retrieve the NT hash of the user.

Now we generate a Kerberos TGT for management_svc

LogoShadow Credentials: Abusing Key Trust Account Mapping for Account Takeover - SpecterOpsSpecterOps
LogoGitHub - eladshamir/Whisker: Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.GitHub
LogoGitHub - ShutdownRepo/pywhisker: Python version of the C# tool for "Shadow Credentials" attacksGitHub
https://podalirius.net/en/articles/parsing-the-msds-keycredentiallink-value-for-shadowcredentials-attack/podalirius.net
LogoExploiting and Detecting Shadow Credentials and msDS-KeyCredentialLink in Active DirectoryMedium

Additional Information Sources

LogoAbusing Active Directory ACLs/ACEs | Red Team Noteswww.ired.team
LogoGenericWrite - SpecterOpsSpecterOps

PreviousPrivilege Escalation with bloodyADNextActive Directory Persistence

Last updated